coreapi: explain why ENTIRE_TOKEN path has no cluster-trust gate

The comment claimed coreapi.New "mirrors" the env-token path in git-remote-entire/main.go, but that path adds a cluster-trust gate (ResolveClusterCores + coreTrusted) that this path lacks — exactly the verification CoreURLFromEnvToken's doc mandates of callers.

Drop the misleading "mirrors" framing and state why the gate is absent: control-plane commands have no user-supplied resource host to anchor the trust check against (coreURL would only ever be the token's own unverified aud), and aud-redirection carries no escalation because the token is sent verbatim as the bearer rather than exchanged as an STS subject_token — the token is its own credential.

Comment-only change; no behavior change.